Use label permissions in the project labels controller

Diane Russelrequested to merge
dlrussel/project-labels-granular-permissions into master

What does this MR do and why?

admin_label is one broad permission that covers every label write. GitLab already defines create_label, update_label, delete_label and promote_label, and the REST and GraphQL endpoints already use them for token scopes. No role granted these permissions to users, so the controller still checked admin_label. This MR switches Projects::LabelsController to the specific permissions. Nobody gains or loses access. Reporter and Planner had admin_label and now also get the specific permissions as raw permissions.

  • Controller checks create_label (new, create, generate), update_label (edit, update, set_priorities, remove_priority), delete_label (destroy) and promote_label on the project's group (promote), instead of admin_label.
  • Reporter and Planner role YAML get create_label, update_label, delete_label in the project scope and promote_label in the group scope.
  • Archived and pending-deletion projects already blocked admin_label, create_label and update_label. delete_label is added to those lists, and promote_label to the archived group list. The rule for projects with issues and merge requests turned off blocked destroy_label, a name that was never defined, so it blocked nothing. It now blocks delete_label, and destroy_label is removed from definitions_todo.txt.
  • Promote checks the group because promoting creates a group label. A project reporter with no role on the group gets a 404.

This is the first MR in a stack that moves label checks off admin_label. The next steps are the group labels controller, the REST label endpoints, the GraphQL label mutations, the label UI checks, then Labels::FindOrCreateService, then removing admin_label itself.

No changelog, since user-facing behavior does not change.

References

Related to #566177

Screenshots or screen recordings

No UI change.

How to set up and validate locally

bundle exec rspec spec/controllers/projects/labels_controller_spec.rb spec/policies/project_policy_spec.rb spec/policies/group_policy_spec.rb ee/spec/policies/project_policy_spec.rb
bundle exec rake gitlab:permissions:validate

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Merge request reports